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INTRODUCTION 

Illicit drug distribution has over the past decade grown tremendously from simple "drug pushing" 
where drugs were distributed from poorly organized individuals to today’s well organized and well 
financed drug cartels. This change to a more "corporate-like" atmosphere hag resulted in a greater use 
of record keeping to monitor the profits generated. The use of record keeping by drug distributors is not 
restricted to high level drug smugglers but is used at all levels within the distribution network. Dealers 
at all levels including street dealers are generally "fronted," given on consignment quantities of drugs that 
they m turn sell to customers thereby requiring the need for records to keep track of drug sales versus 
liabilities. These records because of their illicit nature are often encrypted to hide the fact that they are 
indeed records of drug transactions. 

The creation of a handwritten notation concerning a drug transaction is normally brought on 
because of a purchase or sale. In a sale, this is commonly accomplished through a consignment, or the 
designation of a quantity to a customer to whom that amount has been "fronted." Because this activity 
generates a debt, it follows that an accounting for payments made, as well as new transactions completed, 
is only logical. One of the most common means of representing these is through an "accounting flow," 
in which payments are subtracted from a running balance while new sales are added to it. 


The examination of illicit drug records has been they key to the prosecution of numerous federal, 
state and local drug cases for a number of years. The Document Section of the FBI Laboratory, through 
its Racketeering Records Analysis Unit (RRAU), has been involved in such analytical efforts since 1983. 
Detailed analytical research brought about an evolution in the systematic approach utilized in the RRAU 
since that time. (1-3) 

The close proximity of the drugs to the records often results in trace drug evidence being 
transferred to the records. The detection of trace drug residue on surfaces by ion mobility spectrometry 
(IMS) is well documented in the literature. Ion mobility spectrometry (IMS), first introduced by Cohen 
and Karasek in 1970 (4), is experiencing a resurgence of interest in specific purpose detection systems 
because of its analytical flexibility (5). A recent book thoroughly describes the fundamentals and 
applications of IMS (6). Forensic applications of IMS technology from 1970 to 1989 have been thoroughly 
reviewed by Karpas (7). 

The probative value of IMS as an investigative and forensic tool is exemplified in recent 
applications which have included the detection of drug micro-particulates on hands (8,9), determining 
cocaine in injection molded plastic (10), and use in customs scenarios (11). 

The following procedure will deal primarily with the newer techniques of trace drug analysis and 
drug record analysis developed by the Chemistry /Toxicology Unit of the FBI Laboratory since the more 
traditional techniques of latent finger print analysis and document analysis are well known. 
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EXPERIMENTAL PROCEDURE 


Document Analysis: 

The initial visual examination consists of studying the documents to determine if the notations 
thereon relate to the buying and/or selling of a product. Figure 1 shows a typical clandestine drug record. 
If the answer is yes, the procedure then calls for a closer look at the type of product involved. In the case 
of illicit drug records, the drug(s) are not normally identified, at least to the extent that a legitimate 
commodity would be. However, a relationship is often found between units and corresponding prices that 
may be consistent with certain quantities of illicit drugs. This relationship is one of the class characteristics 
of illicit drug records. If the weight can be decided, this may lead to the identification of the drug that is 
an example of an individual characteristic. Coded or abbreviated customer names (ref. to herein as 
"account designation”), partial dates, and lack of product and weight identifiers are all used to compare 
and contrast clandestine drug records with legitimate business records. 

The relationships between and among various notations are frequently found mathematically. 
These relationships are then carefully studied, along with application of knowledge about how illicit drugs 
are bought and sold. For example, conversions from one weight system to another are accomplished 
through commonly applied formulas recognized in these examinations. The determination of the system 
used may also aid in the identification of the drug involved but often requires many numerical comparisons 
in order for a conclusion to be reached. 

Besides numerical notations, slang terms, simple accounting terminology, as well as references 
to weights (grams, ounces, kilos, pounds, etc.) may provide clues as to the "flow" of quantities of drugs 
between supplier and distributor, between distributor and customer, or among employees of a drug 
business. These words or abbreviations commonly include "paid," "owed," "balance," "delivered," 
"returned," "profit," "expenses," "incoming," and "outgoing," usually in English or Spanish. Slang terms 
may aid in identification of the drug, and include references to the drugs ("pot," "weed," "rocks," "crank," 
"crack," etc.) or descriptive terms ("mold," "wet," "shake," etc.) 

Class Characteristics . In maintaining illicit drug records, dealers frequently use 28 as the 
approximate number of grams in one ounce. Related conversions include 14 grams in 1/2 ounce, 7 grams 
in 1/4 ounce, 3.5 grams in 1/8 ounce ("eightball"), and 1.75 grams in 1/16 ounce. Multiples of 28 may 
suggest ounce equivalents in larger quantities, i.e. , 56 grams in 2 ounces, 84 grams in 3 ounces, 1 12 grams 
in 4 ounces, etc. In even larger quantities, 224 grams equals 8 ounces (1/2 pound), and 448 grams equals 
16 ounces (1 pound). One pound may also be suggested by the more accurate (though still not precise) 
equivalent of 453 or 454 grams. Such variations may be encountered even within the same set of 
documents. 

In like fashion, the breakdown of kilogram weights into gram quantities is often made in easily 
recognized patterns. With 1,000 grams in a kilogram and 500 grams in 1/2 kilo, it follows that 1/4, 1/8, 
and 1/16 of a kilo could be recorded as 250, 125, and 62.5 grams respectively. Actually, these types of 
references are noted frequently in clandestine drug records. 

In records of large-scale, multi-kilo cocaine distribution records, three general types of documents 
are often encountered. First, an inventory of incoming and outgoing kilos may provide a summary of the 
quantities received and distributed by the business over a specific period. Second, individual account pages 
show the debts incurred and payments made by various customers. Third, the business's cash ledger may 
show payments received from customers or employees as well as expenditures by the business. These may 
include office transportation and utility expenses as well as larger amounts deducted as payments to the 
business's cocaine supplier or for laundering purposes. 
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Individual characteristics. Sometimes the markings on kilo packages of cocaine (which serve as 
product identifiers, or brand names) are recorded as part of the inventory procedure. These may be studied 
for possible relationships between various search locations and links to seizures of cocaine or records seized 
in connection with previously unrelated investigations. These markings may consist of stickers, logos, 
symbols, or names (some common ones include "Rolex," "Baby," "Cartier," and "Leon.") Such specific 
indicators as these are examples of individual characteristics of illicit cocaine distribution records. 

Marijuana records may detail inventories and distribution of hundreds or even thousands of 
pounds. Marijuana package weights in such documents often show pounds recorded to the left of a decimal 
point and ounces to the right. For example, 10 1/4 pounds might be expressed as "10.4" or "10.04." A 
determination that this is so might entail repeated checks of the computations noted to compare totals. If 
totals are in dispute, this may explain how the totals were calculated in ways unique to illicit marijuana 
distribution businesses. 

Coded Records . Although illicit drug records are not always deliberately encoded, they often 
appear cryptic in nature. This is usually due to the absence of certain notations that would make them 
more meaningful. For example, writers often drop zeros in recording large amounts of money, possibly 
because including them is simply too cumbersome and time-consuming. Thus, $23,500 as a price for one 
kilo of cocaine might be written as “23.5." Mathematical proof that zeros have been dropped may be 
found when the writer mistakenly records the full notation, or through calculations made to show partial 
payments such as "$21,357." 

In addition, simple substitution ciphers may be utilized by drug dealers or their bookkeepers. 
These are frequently based on 10-letter key words that contain no repeated letters. These may then be used 
to substitute for digits in telephone numbers or in the accounting records themselves. For example, the 
letters "M-O-N-E-Y-T-A-L-K-S" might be substituted for the numbers 1 through 9 and 0. Breaking such 
codes may be possible through mistakes made by the writer or through mathematical computations. 

Instrumental Analysis 


Ion Mobility Spectrometry. A sample to be examined is vacuumed using a standard vacuum with 
an attachment specifically designed to allow the collection of drug residue on a Teflon filter (4 micron 
mesh). Following the collection of the residue from the subject document the filter is removed from the 
vacuum and placed (see figure 2) into the sample holder in the Ionscan, an ion mobility spectrometer for 
analysis. Analysis is accomplished by heating of the filter at a temperature of 250 degrees Centigrade for 
four seconds to volatilize the analyte. Figure 3 shows a block diagram of the IMS. The analyte enters a 
chamber where ionization of the drug is accomplished under atmospheric conditions. The ions that are 
formed are then pulsed into at drift tube (see where they are separated in time and detected at the collector. 
Identification of a drug is determined by the time in milliseconds that an ion takes to transverse the drift 
tube in relation to an internal standard, nicotinamide that is analyzed simultaneously. The collection and 
display (see figure 4) of data are accomplished using a notebook computer linked to the Ionscan via an 
interface card. 

Gas Chromatography /Mass Spectrometry . After a sample is determined to contain a drug the 
filter is again placed into the vacuum and the specimen in question is vacuumed a second time and the filter 
extracted with methanol. The extraction of the filter is accomplished by removing the filter from the filter 
holder and placing it into a small test tube. To the test tube is added approximately two milliliters of 
methanol and the test tube vortexed for thirty seconds. After vortexing of the sample the filter is removed 
and the methanol evaporated to dryness under a stream of nitrogen at sixty degrees centigrade. The 
resulting residue is reconstituted using fifty microliters of methanol and analyzed via GC/MS utilizing a 
Finnigan 4500 fitted with a six-foot 3 % OV-17 and programmed from 60 to 270 degrees Centigrade at 25 
degrees Centigrade per minute. The mass spectrometer is operated in the chemical ionization mode, using 
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methane as a reagent gas. Figure 5 shows the positive ion chemical ionization mass spectrum of cocaine. 

Confirmation of cocaine is also accomplished through solid probe-tandem nmra spectrometry. The 
cocaine residue is introduced into the ionization chamber through a direct solids’ probe. The probe is 
heated from 0 to 300 degrees Centigrade at a rate of 100 degrees Centigrade per minute thereby volatilizing 
the cocaine and ionization in the presence of the reactant gas methane. The resulting M + 1 ion, m Iz 304, 
is subsequently separated by the first quadrapole from the other ions formed. After separation the 304 m/z 
ion is accelerated and collided into argon gas in the second quadrapole causing fragmentation (daughter 
spectrum) which is detected in the third quadrapole. Figure 6 shows the daughter spectrum of cocaine. 

CONCLUSION 

It should be noted that forensic examinations of illicit drug records are made exclusively through 
comparison of all of the documents contained in a given submission taken as a whole. Isolating individual 
notations outside their contextual relationships to other notations in a group of documents may lead to 
difficulties in interpretation and severely limit the benefits to the investigating agency. 

Forensic techniques of the types described above have been used effectively in many so-called "no- 
dope conspiracy cases, and it is in these investigations that they can become the most important element 
of the prosecution. Expert testimony in this area has proven helpful in providing summaries of the 
activities of many illicit drug businesses as well as in describing the scope of such organizations, often in 
great detail. Coupled with other items of factual and circumstantial evidence, it can be a powerful tool for 
both investigators and prosecutors. 

The analysis of the records themselves for traces of the drug being distributed lends further 
evidence that the notations determined by visual inspection are indeed records of drug transactions and not 
related to some other type of business records. The combination of these with other forensic techniques 
such as hair and fiber analysis, latent fingerprint analysis and traditional document analysis offer new 
techniques to combat the increasingly more sophisticated drug distribution networks. 
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Figure 1. A typical clandestine drug record. 
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Figure 2. Photograph of the ion mobility spectrometer. 
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Figure 3. Block diagram of the ion mobility spectrometer. 
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Figure 4. Plasmagram showing the detection of cocaine. 
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Figure 6. MS/MS daugher ion spectrum of cocaine. 


